FPSelect: Low-Cost Browser Fingerprints for Mitigating Dictionary Attacks against Web Authentication Mechanisms

Abstract

Browser fingerprinting consists into collecting attributes from a web browser. Hundreds of attributes have been discovered through the years. Each one of them provides a way to distinguish browsers, but also comes with a usability cost (e.g., additional collection time). In this work, we propose FPSelect, an attribute selection framework allowing verifiers to tune their browser fingerprinting probes for web authentication. We formalize the problem as searching for the attribute set that satisfies a security requirement and minimizes the usability cost. The security is measured as the proportion of impersonated users given a fingerprinting probe, a user population, and an attacker that knows the exact fingerprint distribution among the user population. The usability is quantified by the collection time of browser fingerprints, their size, and their instability. We compare our framework with common baselines, based on a real-life fingerprint dataset, and find out that in our experimental settings, our framework selects attribute sets of lower usability cost. Compared to the baselines, the attribute sets found by FPSelect generate fingerprints that are up to 97 times smaller, are collected up to 3, 361 times faster, and with up to 7.2 times less changing attributes between two observations, on average.

BrFAST: a Tool to Select Browser Fingerprinting Attributes for Web Authentication According to a Usability-Security Trade-off

“…We evaluated the performances of FPSelect and compared them to the baselines based on entropy and conditional entropy [1]. The experimental setting was composed of a user population of 30, 000 browsers, a number of explored paths of 1 and 3, a sensitivity threshold between 0.001 and 0.025, and a number of submissions by the dictionary attacker between 1 and 16.…”

“…Both the optimal solution and the solution found by FPSelect are among these attribute sets. The exploration algorithm explores in priority the supersets of the most efficient 2 attribute sets and includes three pruning methods [1] to reduce the number of explored attribute sets. The exploration algorithm is inspired by the Beam Search algorithm [9] and is part of the Forward Selection algorithms [13].…”

“…The elements of this lattice are the subsets of the candidate attributes and the order is the subset relationship. FPSelect leverages an exploration algorithm [1] to find the attribute set that satisfies the sensitivity threshold at a low cost. It starts from the empty set and explores k-paths in the lattice until all the paths reach the satisfiability frontier, k being a parameter.…”

“…However, the entropy does not consider the correlations that occur between the attributes. Moreover, the entropy and the conditional entropy do not capture the usability cost induced by the use of the attributes [1]. As for the evaluation of every possibility, we emphasize that it is impractical as the number of possibilities grows exponentially with the number of attributes.…”

“…Browser fingerprinting [1,4,7,11] is the collection of attributes from a web browser to build a potentially unique fingerprint. Initially used to track users on the web, this technique can also supplement passwords as an additional web authentication factor as This paper is published under the Creative Commons Attribution 4.0 International (CC-BY 4.0) license.…”